MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a4f6f184148b49522ee0ff07468462eb75fd3b8701ca9498f5c04e90a29fa61. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ACRStealer

Vendor detections: 14

Intelligence 14 IOCs YARA 16 File information Comments

SHA256 hash:	5a4f6f184148b49522ee0ff07468462eb75fd3b8701ca9498f5c04e90a29fa61
SHA3-384 hash:	4ff5be908d38550829aabd3fb4997644e0b6188d2c938cd1dc36e2e3a307728a53bfb0316f0b52913f22cc9fc6a2fd48
SHA1 hash:	2d8f4db9b2d45122a4aa2f7e336f77dc7731e806
MD5 hash:	a9eebe1cb0f2b7582581b5a1bfb364b2
humanhash:	florida-five-avocado-massachusetts
File name:	file
Download:	download sample
Signature	ACRStealer Create hunting rule
File size:	18'493'088 bytes
First seen:	2025-11-14 13:22:37 UTC
Last seen:	2025-11-14 13:23:53 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	8a6efacc9c79e3588a2dd442ee1122cf (1 x ACRStealer)
ssdeep	196608:jVU75hhwk9FKOU8wBSVW9Qq7g3aRA93r2uWk:5+5zp3KOU8wBv9Q0iFrWk
TLSH	T131176C1732EC0198F0BB927D8A9BDA46EA7278154711CBCF19E0425D1E37ED84E7E722
TrID	47.6% (.EXE) Inno Setup installer (107240/4/30) 19.1% (.EXE) InstallShield setup (43053/19/16) 18.4% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 4.6% (.EXE) Win64 Executable (generic) (10522/11/4) 4.4% (.EXE) DOS Borland compiled Executable (generic) (10000/1/2)
Magika	pebin
Reporter	Bitsight
Tags:	ACRStealer dropped-by-amadey exe fbf543

Bitsight

url: http://178.16.55.189/files/ne/random.exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2025-11-14 13:23:33 UTC

Tags:

delphi stealer

Link:

https://app.any.run/tasks/9d30cc12-15b3-4f87-991f-b17c9f8a3386

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/38206/

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69172d51bdb0ec3a9dc15a2d

Tags:

dropper delphi

Result

Verdict:

Malware

Maliciousness:

Behaviour

Adding an access-denied ACE

Connection attempt

Sending a custom TCP request

Forced shutdown of a browser

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context anti-debug embarcadero_delphi fingerprint genheur installer-heuristic invalid-signature keylogger overlay overlay overlay packed signed

Link:

https://www.filescan.io/uploads/69172d48253c565f83ff23a6/reports/637f6ca8-ae23-4ca9-99c4-f5cc36fb602f/overview

Verdict:

Malicious

Labled as:

Loader.Ropalidia.AM

Link:

https://www.hybrid-analysis.com/sample/5a4f6f184148b49522ee0ff07468462eb75fd3b8701ca9498f5c04e90a29fa61

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-11-14T10:33:00Z UTC

Last seen:

2025-11-16T10:19:00Z UTC

Hits:

~10

Detections:

UDS:DangerousObject.Multi.Generic

Link:

https://opentip.kaspersky.com/5a4f6f184148b49522ee0ff07468462eb75fd3b8701ca9498f5c04e90a29fa61/results?tab=lookup

Score:

17%

Verdict:

Benign

File Type:

Link:

https://malprob.io/report/5a4f6f184148b49522ee0ff07468462eb75fd3b8701ca9498f5c04e90a29fa61

Verdict:

inconclusive

YARA:

6 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout SVG Win 32 Exe x86

Link:

https://app.malva.re/file/a9eebe1cb0f2b7582581b5a1bfb364b2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5a4f6f184148b49522ee0ff07468462eb75fd3b8701ca9498f5c04e90a29fa61/

Verdict:

Malicious

Threat:

Win32.PUA.Heuristic

Link:

https://tip.neiki.dev/file/5a4f6f184148b49522ee0ff07468462eb75fd3b8701ca9498f5c04e90a29fa61

Threat name:

Win32.Spyware.Acrstealer

Status:

Suspicious

First seen:

2025-11-14 13:23:27 UTC

File Type:

PE (Exe)

Extracted files:

357

AV detection:

13 of 37 (35.14%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ljhw6gcbjc2jkixob7yhi2cgf23v7u5yoaokssmplqcoscrj7jqq._file

Verdict:

malicious

Label(s):

unc_loader_053

Similar samples:

error

ACRStealer

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/251114-qmzcyawrer/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

System Location Discovery: System Language Discovery

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/1efe1158-a24c-4db2-a759-5b18ef43835f

Unpacked files

SH256 hash:

5a4f6f184148b49522ee0ff07468462eb75fd3b8701ca9498f5c04e90a29fa61

MD5 hash:

a9eebe1cb0f2b7582581b5a1bfb364b2

SHA1 hash:

2d8f4db9b2d45122a4aa2f7e336f77dc7731e806

Link:

https://www.unpac.me/results/293ca24b-effe-4823-8898-b6f7a11608a7/

Malware family:

Amatera

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5a4f6f184148/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.56

Link:

https://yomi.yoroi.company/submissions/5a4f6f184148b49522ee0ff07468462eb75fd3b8701ca9498f5c04e90a29fa61

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BLOWFISH_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for Blowfish constants

Rule name:	BobSoftMiniDelphiBoBBobSoft Create hunting rule
Author:	malware-lu

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang Create hunting rule

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	identity_golang Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware

Rule name:	Indicator_MiniDumpWriteDump Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	skip20_sqllang_hook Create hunting rule
Author:	Mathieu Tartare <mathieu.tartare@eset.com>
Description:	YARA rule to detect if a sqllang.dll version is targeted by skip-2.0. Each byte pattern corresponds to a function hooked by skip-2.0. If $1_0 or $1_1 match, it is probably targeted as it corresponds to the hook responsible for bypassing the authentication.
Reference:	https://www.welivesecurity.com/